[pull] trunk from cli:trunk - #1

Deleting a number twice turned a successful delete into a 404, and
downloading it twice failed on the file the first wrote. Both commands
now refuse a repeated number with a usage error, before any request or
prompt. The run tests that pinned the old behavior are gone, since the
run functions can no longer get a repeat.

A successful delete can get 204 No Content, or 200 with the deleted
artifact's number. The client tests now stub those instead of an empty
object, and the client accepts both.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fixes GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and
GO-2026-6617 reported by govulncheck.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bump Go to 1.27.2

Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.23.0 to 0.24.0.
- [Commits](golang/sync@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) from 0.1.15 to 0.1.16.
- [Release notes](https://github.com/mattn/go-colorable/releases)
- [Commits](mattn/go-colorable@v0.1.15...v0.1.16)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-colorable
  dependency-version: 0.1.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…/sync-0.24.0

chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0

…attn/go-colorable-0.1.16

chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16

safepaths opens a blank directory as the current one, so --dir '' wrote every file there. It is now a usage error, like a blank --output.

Remove CLAUDE.md in favor of AGENTS.md

Track whether a highlight is open so line breaks and the end of a fragment
reset it only when needed, and cover formatMatch with color-enabled tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: df8d6bb1-109e-4531-b990-f0c44641b080

Fix the unclean background colors of gh-search-code

When `gh attestation verify` loads attestations with `--bundle` or
`--bundle-from-oci`, it compares the `--repo` or `--owner` value only
with the repository and owner names recorded in the attestation's
certificate when the attestation was created. It cannot tell whether a
name now belongs to a different repository or owner. The default mode
fetches attestations from the GitHub API, which looks up the repository
or owner that currently has the name.

Explain this in the "Loading Artifacts And Attestations" section of the
help text, and point users who need that check to the default mode.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

---
updated-dependencies:
- dependency-name: charm.land/bubbletea/v2
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.57.0 to 0.58.0.
- [Commits](golang/crypto@v0.57.0...v0.58.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…-help

Clarify `--repo` and `--owner` checks for attestation bundles

Add private vulnerability report form

Deleting a private repository also deletes its forks, and the person
deleting often cannot see them. `gh repo delete` now looks up the
repository first. When it is private, not itself a fork, and has forks,
gh asks for confirmation in a terminal, even with `--yes`. Without a
terminal it requires the new `--accept-cascading-deletion-of-private-forks`
flag, which also skips the lookup.

Scripts that fork a private repository delete the upstream with
`gh repo delete --yes`. That cleanup now needs the new flag, in case the
fork's own cleanup did not run or the fork count has not caught up yet.

The script forks a private repository within the test organization, then
checks that `gh repo delete --yes` refuses to delete it and leaves it in
place. It then deletes it with `--accept-cascading-deletion-of-private-forks`.

Require confirmation before `gh repo delete` deletes private forks

Replace synthetic Git output with temporary repository scenarios. Isolate ambient Git configuration, attributes, ignore rules, and repository routing while preserving subprocess coverage instrumentation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 9e5f7d2e-d1db-4b6e-b470-8fa64d63286a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f3f93d09-c411-4f3b-b842-b0d15f9d237a

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.84.0 to 1.85.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.84.0...v1.85.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…g.org/grpc-1.85.0

chore(deps): Bump google.golang.org/grpc from 1.84.0 to 1.85.0

Remove obsolete Git test seams

Pass an option-like ref so a test fails if ShowRefs stops separating
refs from options. The ShowRefs tests run real Git and no longer assert
command arguments, so nothing else caught this.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…test

Test ShowRefs option separator

Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.3.0 to 1.4.0.
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.3.0...v1.4.0)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

---
updated-dependencies:
- dependency-name: charm.land/bubbletea/v2
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/yuin/goldmark](https://github.com/yuin/goldmark) from 1.8.6 to 1.8.7.
- [Release notes](https://github.com/yuin/goldmark/releases)
- [Commits](yuin/goldmark@v1.8.6...v1.8.7)

---
updated-dependencies:
- dependency-name: github.com/yuin/goldmark
  dependency-version: 1.8.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…ubbletea/v2-2.1.1

chore(deps): Bump charm.land/bubbletea/v2 from 2.1.0 to 2.1.1

…igstore/sigstore-go-1.4.0

chore(deps): Bump github.com/sigstore/sigstore-go from 1.3.0 to 1.4.0

…uin/goldmark-1.8.7

chore(deps): Bump github.com/yuin/goldmark from 1.8.6 to 1.8.7

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

chore: regenerate triage workflows with gh-aw v1.0.1

`gh help environment` said the enterprise tokens apply to GitHub
Enterprise Server hosts, but not how `gh` decides a host is one. go-gh
uses GH_TOKEN and GITHUB_TOKEN for github.com, subdomains of ghe.com,
and github.localhost, and the enterprise tokens for every other host:
https://github.com/cli/go-gh/blob/v2.17.0/pkg/auth/auth.go#L63-L84

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

`gh api --help` said GH_TOKEN was for github.com API requests and the
enterprise tokens were for "GitHub Enterprise". Use the same host rules
as `gh help environment`.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

go-gh also uses GH_TOKEN and GITHUB_TOKEN for github.localhost, and the
enterprise token entries already exclude it. List it in the GH_TOKEN
entries of `gh help environment` and `gh api --help` too.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Clarify which hosts use GH_ENTERPRISE_TOKEN